NETWORK SYSTEM, PACKET FORWARDING APPARATUS, AND METHOD OF FORWARDING PACKETS

• US 20110032939A1
• Filed: 07/13/2010
• Published: 02/10/2011
• Est. Priority Date: 08/10/2009
• Status: Abandoned Application

• Current Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Original Assignee: Alaxala Networks Corporation (Fortinet Inc.)
• Inventors: ARAI, Masaya, NOZAKI, Shinji
• Application Number:
  US12/835,261
• Publication Number:
  US 20110032939A1
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 45/54 Organization of routing tables
• CPC Class Codes: H04L 45/72 Routing based on the source address
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

A network system includes: a first network; an authentication server; a second network; a network; and a packet forwarding apparatus, wherein the packet forwarding apparatus includes: a forwarding route table storage storing a first forwarding route table containing packet routing information to the second network, and a second forwarding route table containing packet routing information to the second network and the third network; and a forwarding route table selector that, prior to determination of successful authentication for the terminal apparatus, selects the first forwarding route table as a search forwarding route table, and that upon receipt of determination of successful authentication for the terminal apparatus, selects the second forwarding route table as the search forwarding route table.

Claims

1. A network system comprising:

a first network;

an authentication server configured to execute an authentication process when a terminal apparatus joins the first network;

a second network to which the authentication server is connected;

a third network to which the terminal apparatus and the authentication server are not connected; and

a packet forwarding apparatus being connected to the first network, the second network, and the third network, and forwarding packets,

wherein the packet forwarding apparatus includes;

a forwarding route table storage storing a first forwarding route table that contains packet routing information to a prescribed device connected to the second network, and a second forwarding route table that contains packet routing information to a prescribed device connected to the second network and packet routing information to a prescribed device connected to the third network; and

a forwarding route table selector that, prior to determination of successful authentication for the terminal apparatus by the authentication server, selects the first forwarding route table as a search forwarding route table that is used for searching for a packet routing information applied to packets from the terminal apparatus, and that upon receipt of determination of successful authentication for the terminal apparatus by the authentication server, selects the second forwarding route table as the search forwarding route table.

2. The network system in accordance with claim 1, further comprising:

a search forwarding route table selection table associating sender identifiers that identify the packet sender with the search forwarding route tables; and

a table updater updating the search forwarding route table selection table;

wherein the forwarding route table selector selects the forwarding route table for a received packet according to the search forwarding route table selection table;

the search forwarding route table selection table preliminary associates the first forwarding route table with the sender identifier of the terminal apparatus prior to determination of successful authentication of the terminal apparatus by the authentication server; and

upon receipt of determination of successful authentication of the terminal apparatus by the authentication server, the table updater updates the search forwarding route table selection table so as to associate the second forwarding route table with the sender identifier of the terminal apparatus.

3. The network system in accordance with claim 1, wherein

the network system includes a plurality of the third networks;

the forwarding route table storage stores a plurality of the second forwarding route tables that include packet routing information to prescribed devices connected to mutually different third networks and packet routing information to a prescribed device connected to the second network;

the authentication server notifies the forwarding route table selector of an outcome of the authentication process and of information relating to at least one authorized network that authorized for connection and included among the plurality of the third networks; and

the forwarding route table selector, prior to determination of successful authentication of the terminal apparatus by the authentication server, selects the first forwarding route table as the search forwarding route table applied to packets from the terminal apparatus, and upon receipt of determination of successful authentication of the terminal apparatus by the authentication server, selects the second forwarding route table that contains packet routing information to a prescribed device connected to the at least one authorized network from among the plurality of second forwarding route tables, as the search forwarding route table applied to packets from the terminal apparatus.

4. The network system in accordance with claim 2, wherein

the packets are IP packets;

and

the sender identifier is at least one of the MAC address and the IP address.

5. The network system in accordance with claim 1, wherein

when an authentication for the terminal apparatus connected to first network is revoked by the authentication server, the forwarding route table selector switches back from the second forwarding route table to the first forwarding route table as the search forwarding route table applied to packets from the terminal apparatus.

6. The network system in accordance with claim 3, further comprising:

a forwarding route selector selecting a packet forwarding route; and

a forwarding route table updater updating forwarding route tables stored in the forwarding route table storage;

wherein

in addition to the first forwarding route table and the second forwarding route table, the forwarding route table storage stores a third forwarding route table that includes packet routing information to a prescribed device connected to the first network;

the forwarding route table selector selects the second forwarding route table as the search forwarding route table for forwarding packets from each third network to the first network and the second network, and selects the third forwarding route table as the search forwarding route table for forwarding packets from the second network to the first network; and

the forwarding route table updater, during packet forwarding from the authentication server to the terminal apparatus in the authentication process, adds to the third forwarding route table terminal apparatus routing information representing packet routing information to the terminal apparatus that was selected by the forwarding route selector, and upon receipt of determination of successful authentication of the terminal apparatus by the authentication server, acquires the terminal apparatus routing information from the third forwarding route table and copies the terminal apparatus routing information to the second forwarding route table that is included among the plurality of second forwarding route tables and that contains packet routing information to a prescribed device connected to the at least one authorized network.

7. The network system in accordance with claim 6, wherein

when the authentication of the terminal apparatus connected to the first network is revoked by the authentication server, the forwarding route table updater deletes the terminal apparatus routing information from the second forwarding routing table.

8. The network system in accordance with claim 2, further comprising:

a forwarding route selector selecting packet forwarding routes;

wherein the first forwarding route table and the second forwarding route table are constituted as an integrated forwarding route table;

the search forwarding route table selection table associating the sender identifier with the outcome of the authentication process and with a search forwarding route table identifier indicating the search forwarding route table;

the integrated forwarding route table associating routing information contained in the first forwarding route table and in the second forwarding route table with the outcome of the authentication process and with the search forwarding route table identifier;

the search forwarding route table selection table, preliminary associates the sender identifier of the terminal apparatus with information indicating that the authentication process has not successfully taken place, and with an identifier representing the first forwarding route table as the search forwarding route table identifier prior to determination of successful authentication of the terminal apparatus by the authentication server;

the authentication server notifies the table updater at least the outcome of the authentication process;

the table updater, upon being notified of successful authentication of the terminal apparatus by the authentication server, updates the search forwarding route table selection table so as to associate the sender identifier of the terminal apparatus with information indicating that the authentication process was successful and with an identifier representing the second forwarding table as the search forwarding route table identifier;

for a received packet, the forwarding route table selector looks up the search forwarding route table selection table according to the sender identifier of the packet, and acquires the outcome of the authentication process and the search forwarding route table identifier; and

the forwarding route selector looks up the integrated forwarding route table, and selects a forwarding route for the packet according to the outcome of the authentication process and the search forwarding route table identifier acquired by the forwarding route table selector.

9. The network system in accordance with claim 8, wherein

the network system includes a plurality of the third networks;

the forwarding route table storage stores a plurality of the second forwarding route tables that include packet routing information to prescribed devices connected to mutually different third networks, and packet routing information to a prescribed device connected to the second network;

the authentication server notifies the table updater of the outcome of the authentication process and of an information relating at least one authorized network authorized for connection and included among the plurality of the third networks; and

upon being notified of successful authentication of the terminal apparatus and the information relating to the at least one authorized network by the authentication server, the table updater updates the search forwarding route table selection table so as to associate the sender identifier of the terminal apparatus with information indicating that the authentication process was successful, and, as the search forwarding route identifier, with the identifier identifying the second forwarding route table that contains packet routing information to a prescribed device connected to the at least one authorized network and that is selected from among the plurality of second forwarding route tables.

10. The network system in accordance with claim 9, further comprising:

a combination table associating combinations of the second forwarding route tables that contain packet routing information to prescribed devices connected to the at least one authorized network with combination identifiers that identify the combinations,

wherein the search forwarding route table selection table and the integrated forwarding route table use the combination identifiers as the search forwarding route table identifiers for the second forwarding route tables; and

upon being notified of successful authentication of the terminal apparatus and the information relating to the at least one authorized network by the authentication server, the table updater acquires from the combination table an authorized combination identifier that is a combination identifier of a combination of the second forwarding route tables containing packet routing information to prescribed devices connected to the at least one authorized network, and updates the search forwarding route table selection table so as to associate the sender identifier of the terminal apparatus with information indicating that the authentication process was successful, and with the authorized combination identifier.

11. A packet forwarding apparatus configured to forward packets and to be connected to a first network, a second network to which an authentication server executing an authentication process when a terminal apparatus joins the first network is connected, and a third network to which the terminal apparatus and the authentication server are not connected, comprising:

a forwarding route table storage storing a first forwarding route table that contains packet routing information to a prescribed device connected to the second network, and a second forwarding route table that contains packet routing information to a prescribed device connected to the second network and packet routing information to a prescribed device connected to the third network; and

a forwarding route table selector that, prior to determination of successful authentication for the terminal apparatus by the authentication server, selects the first forwarding route table as a search forwarding route table used for searching for a packet routing information applied to packets from the terminal apparatus, and that upon receipt of determination of successful authentication for the terminal apparatus by the authentication server, selects the second forwarding route table as the search forwarding route table.

12. A method of forwarding packets in a packet forwarding apparatus, the packet forwarding apparatus configured to forward packets and to be connected to a first network, a second network to which an authentication server executing an authentication process when a terminal apparatus joins the first network is connected, and a third network to which the terminal apparatus and the authentication server are not connected,

the method comprising:

(a) storing in the packet forwarding apparatus a first forwarding route table that contains packet routing information to a prescribed device connected to the second network, and a second forwarding route table that contains packet routing information to a prescribed device connected to the second network and packet routing information to a prescribed device connected to the third network; and

(b) prior to determination of successful authentication for the terminal apparatus by the authentication server, selecting the first forwarding route table as a search forwarding route table that is used for searching for a packet routing information applied to packets from the terminal apparatus, and upon receipt of determination of successful authentication for the terminal apparatus by the authentication server, selecting the second forwarding route table as the search forwarding route table.